fluent.conf

<source>
  @type  forward
  @id    input1
  @label @mainstream
  port  24224
</source>

<filter **>
  @type stdout
</filter>

<label @mainstream>

  <filter **>
    @type record_transformer
    <record>
      log_json ${record["log"]}
    </record>
  </filter>

  <filter **>
    @type parser
    @log_level debug
    key_name log_json
    reserve_data true
    remove_key_name_field true
    emit_invalid_record_to_error false
    <parse>
      @type json
    </parse>
  </filter>

  <filter **>
    @type drop_by_timestamp
    # timestamp_ttl_sec 60
    # timestamp_field "@timestamp"
  </filter>

  # <match docker.**>
  #   @type file
  #   @id   output_docker1
  #   path         /fluentd/log/docker.*.log
  #   symlink_path /fluentd/log/docker.log
  #   append       true
  #   time_slice_format %Y%m%d
  #   time_slice_wait   1m
  #   time_format       %Y%m%dT%H%M%S%z
  # </match>
  <match **>
    @type file
    @id   output1
    path         /fluentd/log/data.*.log
    symlink_path /fluentd/log/data.log
    append       true
    # time_slice_format %Y%m%d
    # time_slice_wait   10m
    # time_format       %Y%m%dT%H%M%S%z
  </match>
</label>